jdk/src/share/lib/security/java.security-solaris
author mullan
Tue, 03 Jul 2012 14:56:58 -0400
changeset 13159 b2bf5f74dd06
parent 13046 f75226635385
child 14206 4333b87ed32f
child 14198 071fd6fd257d
permissions -rw-r--r--
7133344: Document the java.security.properties system property feature in the java.security file Reviewed-by: hawtin, mullan, weijun Contributed-by: jason.uh@oracle.com
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
     2
# This is the "master security properties file".
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
#
13159
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     4
# An alternate java.security properties file may be specified
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     5
# from the command line via the system property
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     6
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     7
#    -Djava.security.properties=<URL>
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     8
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     9
# This properties file appends to the master security properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    10
# If both properties files specify values for the same key, the value
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    11
# from the command-line properties file is selected, as it is the last
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    12
# one loaded.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    13
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    14
# Also, if you specify
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    15
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    16
#    -Djava.security.properties==<URL> (2 equals),
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    17
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    18
# then that properties file completely overrides the master security
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    19
# properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    20
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    21
# To disable the ability to specify an additional properties file from
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    22
# the command line, set the key security.overridePropertiesFile
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    23
# to false in the master security properties file. It is set to true
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    24
# by default.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    25
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
# In this file, various security properties are set for use by
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
# java.security classes. This is where users can statically register
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
# Cryptography Package Providers ("providers" for short). The term
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
# "provider" refers to a package or set of packages that supply a
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
# concrete implementation of a subset of the cryptography aspects of
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
# the Java Security API. A provider may, for example, implement one or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
# more digital signature algorithms or message digest algorithms.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
# Each provider must implement a subclass of the Provider class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
# To register a provider in this master security properties file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
# specify the Provider subclass name and priority in the format
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
#    security.provider.<n>=<className>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
# This declares a provider, and specifies its preference
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
# order n. The preference order is the order in which providers are
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
# searched for requested algorithms (when no specific provider is
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
# requested). The order is 1-based; 1 is the most preferred, followed
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
# by 2, and so on.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
# <className> must specify the subclass of the Provider class whose
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
# constructor sets the values of various properties that are required
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
# for the Java Security API to look up the algorithms or other
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
# facilities implemented by the provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
# There must be at least one provider specification in java.security.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
# There is a default provider that comes standard with the JDK. It
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
# is called the "SUN" provider, and its Provider subclass
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
# named Sun appears in the sun.security.provider package. Thus, the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
# "SUN" provider is registered via the following:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
#    security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
# (The number 1 is used for the default provider.)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
# Note: Providers can be dynamically registered instead by calls to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
# either the addProvider or insertProviderAt method in the Security
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
# class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
# List of providers and their preference orders (see above):
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
#
11523
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    68
security.provider.1=com.oracle.security.ucrypto.UcryptoProvider ${java.home}/lib/security/ucrypto-solaris.cfg
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    69
security.provider.2=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/sunpkcs11-solaris.cfg
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    70
security.provider.3=sun.security.provider.Sun
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    71
security.provider.4=sun.security.rsa.SunRsaSign
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    72
security.provider.5=sun.security.ec.SunEC
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    73
security.provider.6=com.sun.net.ssl.internal.ssl.Provider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    74
security.provider.7=com.sun.crypto.provider.SunJCE
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    75
security.provider.8=sun.security.jgss.SunProvider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    76
security.provider.9=com.sun.security.sasl.Provider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    77
security.provider.10=org.jcp.xml.dsig.internal.dom.XMLDSigRI
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    78
security.provider.11=sun.security.smartcardio.SunPCSC
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
90ce3da70b43 Initial load
duke
parents:
diff changeset
    80
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    81
# Select the source of seed data for SecureRandom. By default an
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    82
# attempt is made to use the entropy gathering device specified by
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
# the securerandom.source property. If an exception occurs when
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    84
# accessing the URL then the traditional system/thread activity
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    85
# algorithm is used.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    87
# On Solaris and Linux systems, if file:/dev/urandom is specified and it
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
# exists, a special SecureRandom implementation is activated by default.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
# This "NativePRNG" reads random bytes directly from /dev/urandom.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
# On Windows systems, the URLs file:/dev/random and file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
# enables use of the Microsoft CryptoAPI seed functionality.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
securerandom.source=file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
# The entropy gathering device is described as a URL and can also
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
# be specified with the system property "java.security.egd". For example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
#   -Djava.security.egd=file:/dev/urandom
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    99
# Specifying this system property will override the securerandom.source
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
# setting.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
# Class to instantiate as the javax.security.auth.login.Configuration
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
# provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
login.configuration.provider=com.sun.security.auth.login.ConfigFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
# Default login configuration file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
#login.config.url.1=file:${user.home}/.java.login.config
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
# Class to instantiate as the system Policy. This is the name of the class
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
# that will be used as the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
policy.provider=sun.security.provider.PolicyFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
# The default is to have a single system-wide policy file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
# and a policy file in the user's home directory.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
policy.url.1=file:${java.home}/lib/security/java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
policy.url.2=file:${user.home}/.java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
# whether or not we expand properties in the policy file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
# if this is set to false, properties (${...}) will not be expanded in policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
# files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
policy.expandProperties=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
# whether or not we allow an extra policy to be passed on the command line
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
# with -Djava.security.policy=somefile. Comment out this line to disable
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
# this feature.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
policy.allowSystemProperty=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
# whether or not we look into the IdentityScope for trusted Identities
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
# when encountering a 1.1 signed JAR file. If the identity is found
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
# and is trusted, we grant it AllPermission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
policy.ignoreIdentityScope=false
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
# Default keystore type.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
keystore.type=jks
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
# passed to checkPackageAccess unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
# corresponding RuntimePermission ("accessClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
# been granted.
12446
69b93f3b9f85 7160380: Sync JDK8 with JAXP 1.4.5
joehw
parents: 11523
diff changeset
   150
package.access=sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
# passed to checkPackageDefinition unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
# corresponding RuntimePermission ("defineClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
# been granted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
#
13035
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   159
# by default, none of the class loaders supplied with the JDK call
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   160
# checkPackageDefinition.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
#
13046
f75226635385 7171228: closed/java/lang/SecurityManager/CheckPackageDefinition.java failure
asaha
parents: 13042
diff changeset
   162
package.definition=sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
# Determines whether this properties file can be appended to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
# or overridden on the command line via -Djava.security.properties
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
security.overridePropertiesFile=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   171
# Determines the default key and trust manager factory algorithms for
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
# the javax.net.ssl package.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
ssl.KeyManagerFactory.algorithm=SunX509
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
ssl.TrustManagerFactory.algorithm=PKIX
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
# The Java-level namelookup cache policy for successful lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
# any negative value: caching forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
# any positive value: the number of seconds to cache an address for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
# default value is forever (FOREVER). For security reasons, this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
# caching is made forever when a security manager is set. When a security
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   186
# manager is not set, the default behavior in this implementation
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   187
# is to cache for 30 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
# NOTE: setting this to anything other than the default value can have
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   190
#       serious security implications. Do not set it unless
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
#       you are sure you are not exposed to DNS spoofing attack.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   193
#networkaddress.cache.ttl=-1
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
# The Java-level namelookup cache policy for failed lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   197
# any negative value: cache forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
# any positive value: the number of seconds to cache negative lookup results
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
# In some Microsoft Windows networking environments that employ
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
# the WINS name service in addition to DNS, name service lookups
90ce3da70b43 Initial load
duke
parents:
diff changeset
   203
# that fail may take a noticeably long time to return (approx. 5 seconds).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
# For this reason the default caching policy is to maintain these
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   205
# results for 10 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
networkaddress.cache.negative.ttl=10
90ce3da70b43 Initial load
duke
parents:
diff changeset
   209
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
# Properties to configure OCSP for certificate revocation checking
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   213
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   214
# Enable OCSP
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
# By default, OCSP is not used for certificate revocation checking.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
# This property enables the use of OCSP when set to the value "true".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
# NOTE: SocketPermission is required to connect to an OCSP responder.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
#   ocsp.enable=true
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   223
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
# Location of the OCSP responder
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
# By default, the location of the OCSP responder is determined implicitly
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
# from the certificate being validated. This property explicitly specifies
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
# the location of the OCSP responder. The property is used when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
# Authority Information Access extension (defined in RFC 3280) is absent
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
# from the certificate or when it requires overriding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
#   ocsp.responderURL=http://ocsp.example.net:80
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   235
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
# Subject name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
# of the certificate being validated. This property identifies the certificate
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   241
# of the OCSP responder when the default does not apply. Its value is a string
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   242
# distinguished name (defined in RFC 2253) which identifies a certificate in
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   243
# the set of certificates supplied during cert path validation. In cases where
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
# the subject name alone is not sufficient to uniquely identify the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
# then both the "ocsp.responderCertIssuerName" and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
# "ocsp.responderCertSerialNumber" properties must be used instead. When this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
# property is set then those two properties are ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   249
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
#   ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
# Issuer name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
# distinguished name (defined in RFC 2253) which identifies a certificate in
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   259
# the set of certificates supplied during cert path validation. When this
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   260
# property is set then the "ocsp.responderCertSerialNumber" property must also
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   261
# be set. When the "ocsp.responderCertSubjectName" property is set then this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
# property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
#   ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp"
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   266
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
# Serial number of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
# of hexadecimal digits (colon or space separators may be present) which
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
# identifies a certificate in the set of certificates supplied during cert path
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
# validation. When this property is set then the "ocsp.responderCertIssuerName"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
# property must also be set. When the "ocsp.responderCertSubjectName" property
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
# is set then this property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
#   ocsp.responderCertSerialNumber=2A:FF:00
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   281
6311
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   282
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   283
# Policy for failed Kerberos KDC lookups:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   284
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   285
# When a KDC is unavailable (network error, service failure, etc), it is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   286
# put inside a blacklist and accessed less often for future requests. The
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   287
# value (case-insensitive) for this policy can be:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   288
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   289
# tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   290
#    KDCs in the blacklist are always tried after those not on the list.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   291
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   292
# tryLess[:max_retries,timeout]
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   293
#    KDCs in the blacklist are still tried by their order in the configuration,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   294
#    but with smaller max_retries and timeout values. max_retries and timeout
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   295
#    are optional numerical parameters (default 1 and 5000, which means once
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   296
#    and 5 seconds). Please notes that if any of the values defined here is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   297
#    more than what is defined in krb5.conf, it will be ignored.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   298
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   299
# Whenever a KDC is detected as available, it is removed from the blacklist.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   300
# The blacklist is reset when krb5.conf is reloaded. You can add
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   301
# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   302
# reloaded whenever a JAAS authentication is attempted.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   303
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   304
# Example,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   305
#   krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   306
#   krb5.kdc.bad.policy = tryLess:2,2000
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   307
krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   308
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   309
# Algorithm restrictions for certification path (CertPath) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   310
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   311
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   312
# for certification path building and validation.  For example, "MD2" is
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   313
# generally no longer considered to be a secure hash algorithm.  This section
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   314
# describes the mechanism for disabling algorithms based on algorithm name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   315
# and/or key length.  This includes algorithms used in certificates, as well
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   316
# as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   317
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   318
# The syntax of the disabled algorithm string is described as this Java
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   319
# BNF-style:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   320
#   DisabledAlgorithms:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   321
#       " DisabledAlgorithm { , DisabledAlgorithm } "
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   322
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   323
#   DisabledAlgorithm:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   324
#       AlgorithmName [Constraint]
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   325
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   326
#   AlgorithmName:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   327
#       (see below)
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   328
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   329
#   Constraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   330
#       KeySizeConstraint
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   331
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   332
#   KeySizeConstraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   333
#       keySize Operator DecimalInteger
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   334
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   335
#   Operator:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   336
#       <= | < | == | != | >= | >
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   337
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   338
#   DecimalInteger:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   339
#       DecimalDigits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   340
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   341
#   DecimalDigits:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   342
#       DecimalDigit {DecimalDigit}
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   343
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   344
#   DecimalDigit: one of
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   345
#       1 2 3 4 5 6 7 8 9 0
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   346
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   347
# The "AlgorithmName" is the standard algorithm name of the disabled
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   348
# algorithm. See "Java Cryptography Architecture Standard Algorithm Name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   349
# Documentation" for information about Standard Algorithm Names.  Matching
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   350
# is performed using a case-insensitive sub-element matching rule.  (For
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   351
# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   352
# "ECDSA" for signatures.)  If the assertion "AlgorithmName" is a
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   353
# sub-element of the certificate algorithm name, the algorithm will be
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   354
# rejected during certification path building and validation.  For example,
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   355
# the assertion algorithm name "DSA" will disable all certificate algorithms
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   356
# that rely on DSA, such as NONEwithDSA, SHA1withDSA.  However, the assertion
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   357
# will not disable algorithms related to "ECDSA".
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   358
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   359
# A "Constraint" provides further guidance for the algorithm being specified.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   360
# The "KeySizeConstraint" requires a key of a valid size range if the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   361
# "AlgorithmName" is of a key algorithm.  The "DecimalInteger" indicates the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   362
# key size specified in number of bits.  For example, "RSA keySize <= 1024"
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   363
# indicates that any RSA key with key size less than or equal to 1024 bits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   364
# should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   365
# that any RSA key with key size less than 1024 or greater than 2048 should
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   366
# be disabled. Note that the "KeySizeConstraint" only makes sense to key
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   367
# algorithms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   368
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   369
# Note: This property is currently used by Oracle's PKIX implementation. It
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   370
# is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   371
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   372
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   373
#   jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   374
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   375
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   376
jdk.certpath.disabledAlgorithms=MD2
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   377
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   378
# Algorithm restrictions for Secure Socket Layer/Transport Layer Security
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   379
# (SSL/TLS) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   380
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   381
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   382
# when using SSL/TLS.  This section describes the mechanism for disabling
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   383
# algorithms during SSL/TLS security parameters negotiation, including cipher
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   384
# suites selection, peer authentication and key exchange mechanisms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   385
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   386
# For PKI-based peer authentication and key exchange mechanisms, this list
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   387
# of disabled algorithms will also be checked during certification path
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   388
# building and validation, including algorithms used in certificates, as
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   389
# well as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   390
# This is in addition to the jdk.certpath.disabledAlgorithms property above.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   391
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   392
# See the specification of "jdk.certpath.disabledAlgorithms" for the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   393
# syntax of the disabled algorithm string.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   394
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   395
# Note: This property is currently used by Oracle's JSSE implementation.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   396
# It is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   397
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   398
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   399
#   jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 2048
7047
38b1365f95b2 6945529: Apply fix for CR 6921001 to platform-specific java.security configuration files
vinnie
parents: 7040
diff changeset
   400
i